A May 20, 2025, cyberattack disrupted Kettering Health’s patient systems, telephones and procedures. Key services returned to normal June 10.
Malware that encrypts systems or data, typically accompanied by a ransom demand.
Unauthorized access to systems, accounts, networks, or data.
An unauthorized party accessed or viewed data without evidence that the data was copied, removed, altered, or publicly disclosed.
Authorized users could not access required data because of the incident, even when the data was not encrypted, deleted, or destroyed.
A primary service, system, platform, or operational capability became entirely unavailable.
A service, system, platform, or operational capability remained available only in part or with significant limitations.
Internal or external network connectivity was unavailable or materially impaired.
Telephone, voice-over-IP, call-center, or related voice communication services were unavailable or materially impaired.
A public, customer, employee, student, patient, vendor, or partner portal was unavailable or materially impaired.
Internal business, administrative, operational, or staff-facing systems were unavailable.
A specific application or software platform became unavailable or unusable.
The organization could not process, receive, issue, reconcile, or record payments normally.
Staff, customers, patients, students, residents, or other users could not access records or case information normally.
The organization could not create, update, search, file, approve, transmit, or otherwise process records normally.
Appointment, booking, reservation, dispatch, staffing, or other scheduling functions were unavailable or impaired.
Clinical, diagnostic, pharmacy, patient-care, medical-record, or other healthcare operations were materially affected.
Services continued but with longer processing, response, delivery, or completion times.
The disruption caused an accumulation of unprocessed requests, cases, orders, records, appointments, or other work.
Staff or users had to rely on paper, telephone, in-person, offline, or other manual processes.
The organization redirected users to a different website, office, telephone number, email address, provider, or service channel.
Employees or contractors were unable to perform normal duties because systems, data, facilities, or communications were unavailable.
Customers, residents, patients, students, vendors, or members of the public faced access restrictions or could not use services normally.
The incident materially affected services delivered by or through a vendor, managed service provider, contractor, partner, or other third party.
The incident caused operational effects at customers, affiliates, subsidiaries, partners, tenants, or other dependent organizations.
The victim was listed on a threat actor or ransomware data-leak site as an alleged target or nonpaying victim.
Kettering Health’s May 2025 cyberattack disrupted access to care across its western Ohio health system. We reported canceled procedures, communications failures and ambulance diversion. Later primary notices document service recovery and a separate investigation of potentially affected information.
The operational disruption began May 20. Kettering’s later privacy notice identifies unauthorized access between April 9 and May 20, 2025. April 9 is the earliest supported incident activity; it does not establish that patient services were disrupted throughout April. Official acknowledgments and recovery updates support high confidence in the cyber incident and resulting service disruption.
The original local report described unavailable telephone lines and MyChart access, canceled elective procedures and diverted ambulances. It also reported that Premier Health activated an internal code yellow and lost access to communications used to exchange imaging and medical records with Kettering. Those effects concern regional care coordination and diversion preparations; they do not establish an intrusion at Premier.
Kettering’s operational updates said hospitals, clinics and emergency departments remained open while teams used alternate procedures. Patients faced rescheduling and temporary telephone channels. All emergency departments ended diversion May 28, and core Epic electronic health record functions returned June 2.
Surgeries had resumed by June 9, although MyChart remained limited that day. On June 10, Kettering reported normal operations for key hospital and outpatient services, restored MyChart access and functional telephone lines and call centers. A June 13 update announced retirement of the temporary urgent support line for June 16. June 10 supports the operational end; subsequent privacy review and notifications do not establish continuing service disruption.
Kettering’s investigation-based assessment identifies Interlock as the group it believes carried out the attack. A matching ransomware.live listing was discovered June 4; discovery is not the attack date or a verified original publication time. The local newspaper reported an anonymous source’s account of a 72-hour negotiation deadline and threats to destroy or publish data. Those terms remain attributed reporting, and Kettering has not disclosed payment details.
The privacy notice says files may have been viewed or acquired without authorization. Potentially affected information varies by person and includes personal identifiers, medical or treatment information, insurance and billing records, financial information and credentials. It does not establish that all listed categories affected everyone or that every potentially accessed file was stolen. Kettering said it had no evidence of identity theft or fraud involving the information.
A June 16, 2026, notice on behalf of KH Credit Union says a limited amount of member information was held on Kettering’s network. It expressly excludes the credit union’s own network from the incident. This supports an affected data relationship, rather than a separate credit union intrusion.
The reviewed evidence does not establish the initial entry technique, extent of file encryption, ransom amount or payment outcome. The precise information affected for each person and the full affected population remain uncertain. System-wide disruption does not establish identical effects at every facility, and the later privacy investigation should not be used to extend the clinical outage.
Kettering Health says its investigation gives it reason to believe Interlock carried out the May 2025 incident. The exact-name and domain claim searches returned the same Interlock listing, discovered June 4, 2025. The original listing publication time is unverified; discovery is not attack onset. Preserve the victim’s qualified assessment. This record does not independently verify the actor’s file counts, encryption scope or ransom terms.
Dayton anchors Premier Health’s shared administration. The reported downstream communications restrictions and diversion preparations support this organization-place association; they do not establish a separate intrusion or a building-specific outage.
Kettering anchors the main hospital campus affected by system-wide patient-care and communications disruptions. This site relationship does not establish disruption of all services across the city.
Miamisburg anchors the affected health system’s principal administrative offices. The system-wide report does not establish a city-wide outage or a separate intrusion at every facility.
Washington Township anchors the affected credit union’s main office. The documented effect concerns member data held by Kettering Health; it does not establish an intrusion or service outage at this office.
Signed-in members can report an error, update, or missing source.
